DevOps & Kubernetes (50 Qs)•Part 2: Kubernetes Architecture & Core Workloads (11 - 25)
ConfigMaps & Secrets: Volume mounts vs. environment variables, automatic reloading, and KMS encryption.
Secret Management & Injection Patterns
Storing configuration and sensitive credentials in Kubernetes requires careful consideration of security, immutability, and dynamic updates.
sql
+------------------------------------+
| HashiCorp Vault / AWS SM |
+------------------------------------+
|
v (External Secrets Operator)
+------------------------------------------------------------------------+
| Kubernetes Cluster |
| |
| +-------------------+ +----------------------------------+ |
| | Secret | | ConfigMap | |
| | (Encrypted via | | (Non-sensitive application conf) | |
| | AWS KMS envelope) | +----------------------------------+ |
| +-------------------+ | |
| \ / |
| v v |
| +---------------------------------------------+ |
| | App Pod | |
| | - Env Var: Static (Requires Pod Restart) | |
| | - Volume Mount: Dynamic (Auto-updates file) | |
| +---------------------------------------------+ |
+------------------------------------------------------------------------+
Volume Mount vs. Environment Variable
| Injection Method | Auto-Updates When Secret Changes? | Security Risk |
|---|---|---|
Environment Variable (valueFrom) | No. Value is frozen at container startup. Requires Pod rolling restart. | Can leak via /proc/<pid>/environ, crash dumps, and debugging tools. |
Volume Mount (mountPath) | Yes. Kubelet updates the symlinked volume within ~60 seconds via atomic swap. | Lower risk. Application must watch the filesystem for changes. |
Production Encryption & Synchronization
- Encryption at Rest in etcd: By default, secrets are stored in etcd in base64 (unencrypted). In production, configure KMS Envelope Encryption in the API Server with AWS KMS or HashiCorp Vault.
- External Secrets Operator (ESO): Never commit Secrets to Git. Sync them automatically from AWS Secrets Manager or Azure Key Vault into native Kubernetes Secrets.